Cybersecurity defenders and threat intelligence analysts are tracking a significant operational shift by Storm-1175, a financially motivated threat cluster associated with China-linked operations. Disclosed by Microsoft Threat Intelligence on August 10, 2026, the adversary has abandoned third-party ransomware strains in favor of a newly developed, custom-built ransomware family called StormEncryptor.

Inside the StormEncryptor Technical Capabilities

Historically known for deploying Medusa ransomware, Storm-1175’s adoption of StormEncryptor highlights an increasing trend toward proprietary offensive tooling. Written in optimized C++, StormEncryptor is designed to maximize damage across enterprise Windows environments and network-attached storage (NAS) devices.

Key technical characteristics of the malware include:

• Targeted File Encryption: Recursively scans local drives and mapped SMB shares, executing high-speed multi-threaded encryption and appending the .encrypted file extension.
• Ransom Note Dropper: Places ransom notes titled !!!README_FIRST!!!.txt in every processed directory, providing instructions for TOR-based ransom negotiations.
• Shadow Copy Destruction: Systematically purges Volume Shadow Copies (VSS) and disables Windows Event Logging to hinder forensic analysis and local system recovery.

Exploiting Remote Monitoring & Management (RMM) Vectors

Investigation into recent intrusion sets reveals that Storm-1175 primarily achieves initial access by exploiting vulnerabilities in exposed enterprise management infrastructure—specifically targeting unpatched remote monitoring and management (RMM) solutions like N-able N-central.

Once inside, the threat actors execute credential harvesting, deploy unauthorized Cloudflare Tunnels to maintain persistent administrative access, and stage domain-wide deployment via Active Directory Group Policy Objects (GPOs).

Enterprise Defense & Threat Hunting Guidance

To defend against Storm-1175 intrusion campaigns and mitigate StormEncryptor execution risks, security operations centers (SOCs) should adopt the following measures:

• Harden Remote Management Infrastructure: Immediately update all RMM platforms and gateway controllers to the latest vendor-patched builds.
• Monitor Unsanctioned Tunneling Utilities: Configure Endpoint Detection and Response (EDR) rules to detect unauthorized outbound connections established by cloud tunneling binaries (e.g., cloudflared.exe).
• Enforce Immutable, Offline Backups: Maintain strict air-gapped backup architectures to ensure business continuity without paying ransom demands.

Source: The Hacker News / Microsoft Threat Intelligence